unquote

Build provenancecaution

No build attestation or trusted-publisher metadata is present. This limits publication transparency, but the small, directly inspectable artifact and absent install scripts partly offset the gap.

Maintainerscaution

Only one registry account has publish access. That is not proof of abandonment, but it indicates limited publishing redundancy when combined with the lack of recent activity.

Project backingcaution

The repository is owned by an individual account rather than an organization, providing limited visible institutional backing. The repository still appears relevant because its README mentions the package.

Release historycaution

The package has only 3 releases, with the latest in December 2017 and none in the last 12 months. That long period without releases is a meaningful maintenance concern, though the package is small and stable.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months, consistent with the repository's last push in 2017. This is the main maintenance and abandonment concern.